Log4j2 vulnerability mitigation - JndiLookup Removal

[JosephAnis]

Hi All,
We are working on mitigating the Log4j2 vulnerability by removing the JndiLookup class as described here:

Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation

Note — These instructions only apply if you are running Logstash 5.0.0 - 6.8.20, or 7.0.0 - 7.16.0. If you are running an older version of Logstash, or a version of Logstash >= 6.8.21 in the 6.x series or >= 7.16.1 in the 7.x series, these instructions do not apply. Please follow the guidance in main announcement Instructions for removing JndiLookup from relevant JAR files​ These instructions only apply to users running Logstash versions between 5.0.0 and 6.8.20 (inclusive) or between 7.0.0 a…

We are using version 7.9.2 for all ELK components and currently we can't upgrade to newer version.
My question, is the JndiLookup being used by logstash ? Is there any impact expedted if it was removed or it is safe to remove it?
Thanks a lot

[Badger]

@JosephAnis

is the JndiLookup being used by logstash ?

Not unless you have configured your log4j2.properties to contain a JNDI lookup. (This would be very unusual, and is definitely not something you could do by accident.)